CWP is actively maintained; VestaCP is in a strange middle state that neither camp describes accurately. Control Web Panel released CWP7 version 1.2 on 27 July 2026, focused on login and session security, filesystem functions and API hardening. VestaCP's last tagged release, 1.0.0-5, is from 23 November 2021 — nearly five years ago — yet its repository still receives commits, the most recent on 31 July 2026. So it is not abandoned in the way people say, and it is also not shipping releases you can install.
The VestaCP situation, stated precisely
You will read two claims about VestaCP, and both are wrong in different directions.
The first is that it is dead. It is not: the repository shows ongoing work, including commits in the last week of July 2026 touching secure random generation and OS upgrade handling. Somebody is maintaining the code.
The second is that it is fine. Also no. Releases are what users install, and there has not been a tagged one since November 2021. Install VestaCP the normal way today and you are deploying four-and-a-half-year-old code, regardless of what the master branch contains. Unless you are prepared to run from source and track a branch yourself — which almost nobody choosing a free panel wants to do — the practical situation is that your panel is frozen in 2021 while the software it manages is not.
For a control panel that runs as root and exposes a web interface, that gap is the whole argument. Not because a specific exploit is circulating, but because a panel whose release process has stopped has no route to get a fix to you when one is needed.
This is also why HestiaCP exists. It was forked from VestaCP in 2019 precisely because development had stalled, and it has been the community's continuation ever since. If you like the VestaCP model, that is where it lives now.
What CWP is doing instead
CWP's release cadence is unglamorous and steady, which is exactly what you want from this category of software. Version 1.2 of CWP7, on 27 July 2026, was a security release: improved login and session handling, hardened filesystem functions, and API security work, plus operational scripts for log cleaning and disk quota checks. The release before it, in June 2026, fixed a disclosed vulnerability, updated Roundcube and ionCube, and removed the aging WebFTP component.
That last item is a good signal. Removing a feature because it has become a liability is a maintenance decision that projects in decline never make — they leave the old component in place because deleting things upsets users.
Head to head
| CWP (Control Web Panel) | VestaCP | |
|---|---|---|
| Latest release | CWP7 v1.2 — 27 July 2026 | 1.0.0-5 — 23 November 2021 |
| Repository activity | Ongoing | Ongoing commits, no tagged release since 2021 |
| Operating systems | RHEL family — CentOS Stream, AlmaLinux, Rocky, Oracle | Older CentOS, Debian and Ubuntu releases |
| Cost | Free core, optional paid Pro tier | Free |
| Included with Roundcube | Included, on the 2021 stack | |
| Successor project | — | HestiaCP, forked 2019 |
CWP's own rough edges
None of the above makes CWP a beautiful piece of software, and it is worth being straight about it.
The interface is dense and inconsistent — it grew feature by feature over many years and it shows. Documentation is thin in places, and you will end up on forum threads more often than you would like. The free and Pro split is not always obvious until you click something and discover which side of the line it is on. And it is RHEL-family only, so if you standardise on Debian or Ubuntu, CWP is simply not for you.
What it is, reliably, is a free panel that runs on AlmaLinux and Rocky, ships a working mail server, and gets security patches. In a category where several well-known names cannot say all three, that is worth more than polish.
If you are running VestaCP right now
You have three sensible options and one bad one.
Migrate to HestiaCP if you are on Debian or Ubuntu. It is the direct continuation of the project, the concepts map across, and the migration is the least disruptive of the three.
Migrate to CWP if you are on a RHEL-family system and want to stay free. Different concepts, more relearning, but actively patched.
Move to a commercial panel if the server hosts other people's sites and you have concluded that Unix permissions are not enough isolation. That is a real reason to pay, and it is roughly where products like Panelica sit — cgroup v2 ceilings and namespace isolation per account, on both distribution families, with mail included. Whether it is worth it depends entirely on whether you would use those layers.
The bad option is staying on a 2021 release because nothing has gone wrong yet. Panels are the most attacked surface on a hosting server; "no incident so far" is not a security posture, it is a sample size.
Frequently asked questions
Is VestaCP dead in 2026?
Not exactly, and the distinction matters. Its repository still receives commits — the most recent on 31 July 2026 — but its last tagged release, 1.0.0-5, dates from 23 November 2021. A normal installation therefore deploys code from 2021 even though development activity continues in the source tree.
What replaced VestaCP?
HestiaCP, forked from VestaCP in 2019 when development stalled. It keeps the same general model with a rewritten, actively maintained codebase and regular security releases.
Is CWP still updated?
Yes. CWP7 version 1.2 was released on 27 July 2026 with security improvements to login and session handling, filesystem functions and the API. The previous release in June 2026 fixed a disclosed vulnerability and updated bundled components.
Does CWP run on AlmaLinux or Rocky Linux?
Yes. CWP targets the RHEL family, including CentOS Stream, AlmaLinux, Rocky Linux and Oracle Linux. It does not support Debian or Ubuntu.
Is CWP free?
The core panel is free and fully functional. An optional paid Pro tier adds features such as an advanced file manager, backup rotation and a ModSecurity interface, and support is sold separately from the Pro licence.